Candidate: CVE-2021-22885
PublicDate: 2021-05-27 12:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22885
 https://github.com/rails/rails/commit/c4c21a9f8d7c9c8ca6570bdb82d64e2dc860e62c (main)
 https://github.com/rails/rails/commit/f202249bdd701f908a57d733e633d366a982f8ce (v6.0.3.7)
 https://github.com/rails/rails/commit/3eb9e74c287750a9fe11f700fc96d3be1e83aa35 (v5.2.4.6)
Description:
 A possible information disclosure / unintended method execution
 vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or
 `polymorphic_url`helper with untrusted user input.
Ubuntu-Description:
Notes:
 seth-arnold> In Oneiric-Saucy, rails package is just for transition;
 seth-arnold> The rails package contains actual code from vivid onward
Mitigation:
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N [7.5 HIGH]

Patches_rails:
upstream_rails: needs-triage
precise/esm_rails: DNE
trusty_rails: ignored (out of standard support)
trusty/esm_rails: DNE
xenial_rails: ignored (end of standard support, was needs-triage)
bionic_rails: needs-triage
focal_rails: needs-triage
groovy_rails: ignored (reached end-of-life)
hirsute_rails: ignored (reached end-of-life)
impish_rails: needs-triage
jammy_rails: needs-triage
devel_rails: needs-triage

Patches_ruby-rails-3.2:
upstream_ruby-rails-3.2: needs-triage
precise/esm_ruby-rails-3.2: DNE
trusty_ruby-rails-3.2: ignored (out of standard support)
trusty/esm_ruby-rails-3.2: DNE
xenial_ruby-rails-3.2: DNE
bionic_ruby-rails-3.2: DNE
focal_ruby-rails-3.2: DNE
groovy_ruby-rails-3.2: DNE
hirsute_ruby-rails-3.2: DNE
impish_ruby-rails-3.2: DNE
jammy_ruby-rails-3.2: DNE
devel_ruby-rails-3.2: DNE

Patches_ruby-actionpack-3.2:
upstream_ruby-actionpack-3.2: needs-triage
precise/esm_ruby-actionpack-3.2: DNE
trusty_ruby-actionpack-3.2: ignored (out of standard support)
trusty/esm_ruby-actionpack-3.2: DNE
xenial_ruby-actionpack-3.2: DNE
bionic_ruby-actionpack-3.2: DNE
focal_ruby-actionpack-3.2: DNE
groovy_ruby-actionpack-3.2: DNE
hirsute_ruby-actionpack-3.2: DNE
impish_ruby-actionpack-3.2: DNE
jammy_ruby-actionpack-3.2: DNE
devel_ruby-actionpack-3.2: DNE

Patches_ruby-activesupport-3.2:
upstream_ruby-activesupport-3.2: needs-triage
precise/esm_ruby-activesupport-3.2: DNE
trusty_ruby-activesupport-3.2: ignored (out of standard support)
trusty/esm_ruby-activesupport-3.2: DNE
xenial_ruby-activesupport-3.2: DNE
bionic_ruby-activesupport-3.2: DNE
focal_ruby-activesupport-3.2: DNE
groovy_ruby-activesupport-3.2: DNE
hirsute_ruby-activesupport-3.2: DNE
impish_ruby-activesupport-3.2: DNE
jammy_ruby-activesupport-3.2: DNE
devel_ruby-activesupport-3.2: DNE

Patches_ruby-activerecord-3.2:
upstream_ruby-activerecord-3.2: needs-triage
precise/esm_ruby-activerecord-3.2: DNE
trusty_ruby-activerecord-3.2: ignored (out of standard support)
trusty/esm_ruby-activerecord-3.2: DNE
xenial_ruby-activerecord-3.2: DNE
bionic_ruby-activerecord-3.2: DNE
focal_ruby-activerecord-3.2: DNE
groovy_ruby-activerecord-3.2: DNE
hirsute_ruby-activerecord-3.2: DNE
impish_ruby-activerecord-3.2: DNE
jammy_ruby-activerecord-3.2: DNE
devel_ruby-activerecord-3.2: DNE

Patches_ruby-activemodel-3.2:
upstream_ruby-activemodel-3.2: needs-triage
precise/esm_ruby-activemodel-3.2: DNE
trusty_ruby-activemodel-3.2: ignored (out of standard support)
trusty/esm_ruby-activemodel-3.2: DNE
xenial_ruby-activemodel-3.2: DNE
bionic_ruby-activemodel-3.2: DNE
focal_ruby-activemodel-3.2: DNE
groovy_ruby-activemodel-3.2: DNE
hirsute_ruby-activemodel-3.2: DNE
impish_ruby-activemodel-3.2: DNE
jammy_ruby-activemodel-3.2: DNE
devel_ruby-activemodel-3.2: DNE

Patches_rails-4.0:
upstream_rails-4.0: needs-triage
precise/esm_rails-4.0: DNE
trusty_rails-4.0: ignored (out of standard support)
trusty/esm_rails-4.0: DNE
xenial_rails-4.0: DNE
bionic_rails-4.0: DNE
focal_rails-4.0: DNE
groovy_rails-4.0: DNE
hirsute_rails-4.0: DNE
impish_rails-4.0: DNE
jammy_rails-4.0: DNE
devel_rails-4.0: DNE